WEBVTT 1 00:00.000 --> 00:07.320 Look DevOps and DevSecOps, this is a really, really large topic. It takes a lot 2 00:07.320 --> 00:07.920 of people 3 00:07.920 --> 00:14.320 many, many months or years to really wrap their head around it. So don't feel 4 00:14.320 --> 00:15.160 bad if 5 00:15.160 --> 00:19.960 this is a set of content that you got to watch a couple times. Whole careers 6 00:19.960 --> 00:21.000 are built around 7 00:21.000 --> 00:27.130 just managing CI/CD pipelines, let alone adding security into the mix. But you, 8 00:27.130 --> 00:28.000 as a security 9 00:28.000 --> 00:33.790 professional, need to be aware that in software development environments where WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 9 00:28.000 --> 00:33.790 professional, need to be aware that in software development environments where 10 00:33.790 --> 00:35.040 the application 11 00:35.040 --> 00:40.040 itself is the product, this is definitely something you're going to be doing 12 00:40.040 --> 00:40.400 basically 13 00:40.400 --> 00:44.680 full time. It's going to be your whole job. So let's think about some scenarios 14 00:44.680 --> 00:45.200 here. 15 00:45.200 --> 00:49.340 You're reviewing your business practices for delivering code and you think a 16 00:49.340 --> 00:50.320 DevOps pipeline 17 00:50.320 --> 00:55.670 with security might be the solution you need. The manager has asked you 18 00:55.670 --> 00:56.840 specifically why 19 00:56.840 --> 01:01.320 you need a DevSecOps pipeline instead of just a normal DevOps pipeline. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 19 00:56.840 --> 01:01.320 you need a DevSecOps pipeline instead of just a normal DevOps pipeline. 20 01:01.320 --> 01:02.240 Basically, what's 21 01:02.240 --> 01:07.740 the difference? Which of the following best describes the primary goal of a Dev 22 01:07.740 --> 01:08.320 SecOps 23 01:08.320 --> 01:12.800 pipeline? It's actually a little bit of a tricky question. Replace manual QA 24 01:12.800 --> 01:13.520 testing 25 01:13.520 --> 01:18.420 with automated unit tests. Well, that's definitely an objective of a regular 26 01:18.420 --> 01:20.160 DevOps pipeline, 27 01:20.160 --> 01:24.800 but not a DevSecOps pipeline. Automate infrastructure provisioning with zero 28 01:24.800 --> 01:26.040 developer involvement, 29 01:26.040 --> 01:31.890 again, definitely a part of DevOps pipeline, but not DevSecOps. Ensure only WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 29 01:26.040 --> 01:31.890 again, definitely a part of DevOps pipeline, but not DevSecOps. Ensure only 30 01:31.890 --> 01:32.760 developers 31 01:32.760 --> 01:39.150 can deploy code to production. Yep, another DevOps pipeline thing, but not Dev 32 01:39.150 --> 01:40.280 SecOps. 33 01:40.280 --> 01:44.840 Integrate security testing and checks throughout the software development lif 34 01:44.840 --> 01:45.760 ecycle bingo. That's 35 01:45.760 --> 01:51.810 the one we're looking for here. So with that answer being said, that's the sec 36 01:51.810 --> 01:53.440 in DevSecOps. 37 01:53.440 --> 01:59.070 It's all about shifting left, not waiting until the application is deployed to 38 01:59.070 --> 01:59.440 start 39 01:59.440 --> 02:03.980 doing security testing. We want to be doing security testing the whole way WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 39 01:59.440 --> 02:03.980 doing security testing. We want to be doing security testing the whole way 40 02:03.980 --> 02:04.920 through it. 41 02:04.920 --> 02:10.100 You're configuring Bandit in a GitHub actions workflow to fail the pipeline. If 42 02:10.100 --> 02:10.880 any high 43 02:10.880 --> 02:15.780 confidence, medium or higher severity issues are detected, which of the 44 02:15.780 --> 02:17.040 following Bandit 45 02:17.040 --> 02:23.240 command line options would enforce this? Well, Bandit R dot is the start of all 46 02:23.240 --> 02:23.760 of these, 47 02:23.760 --> 02:28.130 and that's right. We want to recursively look through all of the folders 48 02:28.130 --> 02:28.920 starting in 49 02:28.920 --> 02:36.880 this folder, but it's there is no severity flag, nor is there a confidence flag WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 49 02:28.920 --> 02:36.880 this folder, but it's there is no severity flag, nor is there a confidence flag 50 02:36.880 --> 02:37.440 . So I 51 02:37.440 --> 02:44.350 can immediately rule out this one and this one. So that leaves the hyphen L and 52 02:44.350 --> 02:45.120 hyphen 53 02:45.120 --> 02:51.460 I. The kicker here is that we want multiple L's and multiple eyes to detect 54 02:51.460 --> 02:52.960 high confidence 55 02:52.960 --> 02:59.900 or medium to high severity issues. If we only select one L or one I, it would 56 02:59.900 --> 03:01.280 only detect WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 56 02:59.900 --> 03:01.280 only detect 57 03:01.280 --> 03:05.820 low severity issues. So the correct answer is going to be the third answer on 58 03:05.820 --> 03:06.320 my screen. 59 03:06.320 --> 03:09.940 It'll be different on yours because they're randomized, which has multiple L's 60 03:09.940 --> 03:10.640 and multiple 61 03:10.640 --> 03:16.560 L's. A developer adds this Python code to their application. We've seen this 62 03:16.560 --> 03:18.440 one before. When 63 03:18.440 --> 03:23.540 Bandit flags this, what confidence level will it have? Well, the answer here, 64 03:23.540 --> 03:24.320 because we 65 03:24.320 --> 03:29.610 just walked through this example is high. Interestingly, I thought it would 66 03:29.610 --> 03:30.320 have high WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 66 03:29.610 --> 03:30.320 have high 67 03:30.320 --> 03:35.080 severity, but it only flagged this as medium severity. So it was a little wrong 68 03:35.080 --> 03:35.720 on that, 69 03:35.720 --> 03:41.070 but it definitely flagged it with high confidence that it is an issue. So these 70 03:41.070 --> 03:42.120 are some ways 71 03:42.120 --> 03:46.760 that we can start working dev sec ops into our dev ops pipelines.